<?php declare(strict_types=1); if (!defined('DASHBOARD_ROOT')) { http_response_code(403); exit('Direct access denied.'); } if ($_SERVER['REQUEST_METHOD'] !== 'POST') { http_response_code(405); exit(json_encode(['success' => false, 'error' => 'Method not allowed.'])); } header('Content-Type: application/json'); CSRF::enforce(); $phase = $_POST['phase'] ?? ''; $result = ['success' => false, 'error' => 'Unknown phase.']; switch ($phase) { case 'pin': $pin = $_POST['pin'] ?? ''; $result = AuthChain::validatePIN($pin); AuditLogger::log('login.pin_attempt', 'auth', null, ['success' => $result['success'] ?? false]); break; case 'credentials': $username = trim($_POST['username'] ?? ''); $password = $_POST['password'] ?? ''; if ($username === '' || $password === '') { $result = ['success' => false, 'error' => 'Username and password required.']; } else { $result = AuthChain::validateCredentials($username, $password); } AuditLogger::log('login.credentials_attempt', 'auth', null, [ 'username' => $username, 'success' => $result['success'] ?? false, ]); break; case 'secondary': $code = $_POST['code'] ?? ''; $result = AuthChain::validateSecondary($code); AuditLogger::log('login.secondary_attempt', 'auth', null, ['success' => $result['success'] ?? false]); break; default: AuditLogger::log('login.invalid_phase', 'auth', null, ['phase' => $phase]); $result = ['success' => false, 'error' => 'Invalid authentication phase.']; } echo json_encode($result); exit; 